Extracted

• • Target
    50c613d987a58b91daf60860008cb7884c9f181ec0a743e064f2a2e525e617ba
  • Size 4.5MB
  • SHA256 50c613d987a58b91daf60860008cb7884c9f181ec0a743e064f2a2e525e617ba
  • MD5 11ea49672bde8caae2cb324f176eab88
  • SHA1 9a482922e03415451a8ebc2e24cb235511d5a9ef
  • SHA512 fbb7485569b7b74205cf7034b98bf4f14660895ddba5945b829d245f85a2e7274df9216fca5eec933dee79f4105b8b5b01968123fdbf56541b6e7aacd6425c7e
  • SSDEEP 98304:fcsjBAsy/5CcJnbGDZFgWbThk/UXdRSwrx/beRdJskggq+O7CX/:0sU/5Cy8NtYYXSaDePmrLYX/
  • TLSH
    T1FF263351B8C2C5B3D55608361BA5DB10FA7CB9502B19CEC7B3C05A2E8BB56C0E634FE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxmrigminerpersistenceprivilege_escalationupx

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Disables Task Manager via registry modification

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner

  • Executes dropped EXE

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a Windows Service

    persistence

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2